CMS Expedited Life Cycle (XLC) Process: Executive Overview

Transcription

1 Department of Health and Human Services Centers for Medicare & Medicaid Services CMS Expedited Life Cycle (XLC) Process: Executive Overview Version 2.11 August 28, 2014

2 The Centers for Medicare & Medicaid Services (CMS) Expedited Life Cycle (XLC) model offers a simplified information technology (IT) oversight framework to help CMS IT Project Managers, Business Owners, critical partners, and other stakeholders establish necessary reviews/artifacts for IT project oversight based on risk level. The XLC includes three tailored options to accommodate IT projects of varying complexity. The primary purpose of these XLC options is to balance speed and oversight in a manner appropriate to the complexity and risk associated with a particular IT project. High-Level Process Overview An IT project begins at the definition stage, before it can be reviewed and approved. Once approved, the project team executes a development life cycle with involvement from appropriate stakeholders. This ongoing involvement includes the participation of the project team, governance boards, Business Owners, CMS Office of Information Services (OIS), and leadership. The following figure depicts the five key, high-level activities associated with the development life cycle of a typical IT project. Figure 1: High-Level XLC Process As shown in the next figure, each high-level activity has specific tasks and stakeholders: XLC Executive Overview 1

3 Activity 1: Staff Work The project team defines the idea and creates the preliminary set of documentation, starting with the IT Intake Request Form. This documentation articulates the business need, scope, and highlevel architecture. Activity 2: Reviews Activity 2 involves a Business Architecture and Technology Solutions (BATS) Board review to institutionalize governance of the shared services approach through initial needs assessments and architecture reviews. This constitutes the first XLC review, the Architecture Review (AR). The BATS Board may delegate the AR to the Technical Review Board (TRB). Activity 3: Project Approval An approval from the BATS Board kicks off Activity 3, which culminates with an IT Investment Review Board (ITIRB) review that focuses on strategic, enterprise-level shared solutions. This constitutes the second XLC review, the Investment Selection Review (ISR). Activity 4: Project Execution The ITIRB approval marks the start of Activity 4, which constitutes the project execution and any reviews appropriate for that project, depending on the complexity level of that project. Activity 5: Ongoing Performance Monitoring & Measurement Activity 5 is the ongoing performance monitoring throughout the process. Figure 2: Process Flow of the Five Activities XLC Executive Overview 2

4 System Development CMS Expedited Life Cycle (XLC) Options The XLC model provides a streamlined approach to project oversight and execution. XLC is a tailored approach to project execution and governance based on project risk. This model promotes agility, effective project review, and establishing appropriate oversight earlier in the process. The following figure depicts the CMS Expedited Life Cycle model with these five key phases: Initiation, Concept, and Planning Requirements Analysis and Design Development and Test Implementation Operations & Maintenance and Disposition Project risk is assessed and a Complexity Level of 1, 2, or 3 is assigned. The XLC varies the number of reviews depending on the project s risk, as shown in the following figure. Figure 3: CMS Expedited Life Cycle XLC Executive Overview 3

5 Each Complexity Level includes two types of reviews: Governance Board Reviews: Conducted by CMS governance bodies and including relevant stakeholders. Integrated Project Team (IPT)/Independent Assessment Team (IAT) Reviews: Conducted by the IPT/IAT with relevant stakeholders. The IPT may engage members of the governance boards for these reviews. A Project Process Agreement (PPA) establishes a common understanding between all stakeholders on which reviews will be conducted, which artifacts are appropriate, and which tests will be performed. System Development Options The XLC provides Business Owners and IT Project Managers the option to pick one of three tailored XLC oversight options to manage project risk and complexity. This approach offers stakeholders the ability to establish appropriate rigor and oversight. The following definitions and decision criteria are used as a starting point to determine the level of complexity associated with a project as well as the appropriate system development XLC option for that project. Complexity Level 1 Projects: Applies to minor changes to existing services, systems, and/or environments that do not affect the state of any security controls or requirements. Complexity Level 2 Projects: Applies to an isolated, minor, or incremental change with minimal impact to existing systems that does not significantly affect the state of any security controls or requirements. Complexity Level 3 Projects: Applies to a new, one-of-a-kind design and development effort to support an enterprise, center, or department-specific IT solution or a project for a system that has or will have significant security and risk implications. This could be an initial, major development, modernization, or enhancement effort and requires project teams to document detailed requirements, design, and technical solution specifications. Expectations and Risk Considerations The XLC provides the flexibility to fast-track projects and alleviates any delays due to gate review scheduling constraints. The IPT can conduct non-governance board reviews internally within the project. When planning project activities and applicable life cycle processes and while preparing the PPA, it is important to consider the risk of forgoing a review and plan appropriate mitigation strategies to ensure project success. More details about each artifact, stage gate reviews, and potential risks of not having a review altogether are provided in the CMS Expedited Life Cycle Process: Detailed Description document. Governance for the CMS Expedited Life Cycle Several CMS governance bodies review and provide important feedback to projects. CMS is currently streamlining the governance bodies and functions to ensure clear roles, responsibilities, and project guidance. Each governance body s involvement is being assessed to ensure that the appropriate level of oversight is provided in each review by the right group. XLC Executive Overview 4

6 XLC Support for Multiple Development Methodologies The CMS XLC model is methodology-agnostic, meaning that the XLC model supports all forms of development methodologies. XLC governance reviews will thus accommodate the use of Agile and other iterative methodologies. Project Managers are encouraged to conduct IPT and IAT reviews iteratively during the project s life cycle. XLC Drives Streamlined IT Development The CMS XLC model provides Business Owners, Project Managers, and other stakeholders with guidance on selecting the appropriate XLC option. This selection will then influence an IT project s overall governance, oversight processes, documentation requirements, and schedule. The XLC ensures a streamlined approach to project life cycle processes and a flexible approach to project execution, increasing predictability and efficiency. XLC Executive Overview 5